CVE-2026-109964: ImageMagick Buffer Overflow Vulnerability

CVE-2026-109964 Overview

CVE-2026-109964 is a heap buffer underwrite vulnerability in ImageMagick's PICT image decoder. The flaw resides in the DecodeImage() function in coders/pict.c and affects 32-bit builds of ImageMagick before 7.1.2-33 and 6.9.13-58. Attackers can craft a PICT file with maximized row, column, and bytes-per-line values that trigger pointer arithmetic overflow. The overflow bypasses existing bounds checks and allows an attacker to write up to 128 controlled bytes below the target heap buffer. Successful exploitation can cause process crashes or lead to arbitrary code execution in applications that process untrusted PICT images.

Critical Impact
Processing a malicious PICT file on a 32-bit ImageMagick build can corrupt heap memory outside the allocated buffer and potentially yield code execution.

Affected Products

ImageMagick versions prior to 7.1.2-33 (32-bit builds)
ImageMagick 6 versions prior to 6.9.13-58 (32-bit builds)
Applications and services that embed vulnerable ImageMagick libraries for PICT decoding

Discovery Timeline

2026-10-13 - CVE-2026-109964 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109964

Vulnerability Analysis

The vulnerability is categorized as a buffer underwrite [CWE-124] in the PICT image decoder. On 32-bit builds, ImageMagick computes a scanline pointer using the expression q = pixels + y * width * channels. When y, width, and the per-pixel channel count are all large, the multiplication overflows a 32-bit ssize_t. The resulting negative offset causes q to point below the base pixels allocation. The subsequent ReadBlob() call then writes attacker-controlled bytes into memory preceding the heap buffer. Because the attacker controls bytes_per_line, the write can span up to 128 bytes below the allocation. This primitive can corrupt adjacent heap metadata or neighboring allocations, enabling denial of service or arbitrary code execution depending on heap layout.

Root Cause

The root cause is unchecked pointer arithmetic. The decoder validates individual field sizes but does not verify that the computed scanline pointer remains within the allocated buffer. On 32-bit builds, the product y * width * GetPixelChannels(image) wraps around and produces an offset that places q before pixels. The missing invariant check lets execution continue with an invalid destination pointer.

Attack Vector

An attacker delivers a crafted PICT file to any application that uses a vulnerable 32-bit ImageMagick build. Delivery vectors include image upload endpoints, email attachments processed by server-side converters, thumbnail generators, and content pipelines that invoke convert or magick on user-supplied files. No authentication or user interaction is required beyond processing the file.

       for (y=0; y < (ssize_t) image->rows; y++)
       {
         q=pixels+y*(ssize_t) width*(ssize_t) GetPixelChannels(image);
+        if (q < pixels)
+          {
+            status=MagickFalse;
+            break;
+          }
         number_pixels=bytes_per_line;
         count=ReadBlob(blob,(size_t) number_pixels,scanline);
         if (count != (ssize_t) number_pixels)

Source: ImageMagick Commit 63dde0c. The patch adds an invariant check that aborts decoding if the computed scanline pointer q falls below the base pixels allocation, preventing the underwrite.

Detection Methods for CVE-2026-109964

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libMagickCore or libMagickWand when handling PICT files
PICT files with abnormally large rowBytes, rows, or columns header values uploaded to image-processing endpoints
Heap corruption signatures logged by glibc such as malloc(): memory corruption or double free or corruption originating from ImageMagick worker processes

Detection Strategies

Inspect inbound image uploads for the PICT magic bytes and parse header dimensions before passing files to the decoder
Enable ImageMagick's resource limits and policy restrictions to flag abnormal decode operations
Correlate web server logs with ImageMagick process termination events to identify repeated decode failures tied to specific clients

Monitoring Recommendations

Monitor for abnormal exit codes from ImageMagick CLI tools (convert, magick, identify) in batch processing pipelines
Track installed ImageMagick package versions across hosts and alert when 32-bit builds older than 7.1.2-33 or 6.9.13-58 are present
Forward decoder crash telemetry and core dumps to a centralized log store for incident triage

How to Mitigate CVE-2026-109964

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-33 or later, or 6.9.13-58 or later for the 6.x branch
Audit all applications and containers that bundle ImageMagick and replace vulnerable 32-bit builds
Disable the PICT coder in policy.xml where PICT processing is not required

Patch Information

The fix is published in commits 63dde0c for ImageMagick 7 and c18c5d5 for ImageMagick 6. Additional details are available in the ImageMagick GitHub Security Advisory GHSA-mqmp-r5jh-jx7w and the VulnCheck Advisory.

Workarounds

Move image processing workloads to 64-bit builds of ImageMagick, which are not affected by the 32-bit pointer arithmetic overflow
Restrict the PICT decoder through the ImageMagick security policy file until patches are deployed
Validate uploaded image dimensions and reject files whose header fields exceed sane limits before invoking ImageMagick

bash

# Disable the PICT coder in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="PICT" />
</policymap>